Freezmo: self-hosted notes-to-activities study app

Next.js 15 app that turns photos, PDFs, DOCX/PPTX and text into a swipeable
feed of AI-generated activities (flashcards, multiple choice, true/false,
fill-in-the-blank, matching, ordering, short answer) using the user's own
Ollama models.

Highlights:
- All AI calls run in server route handlers; the browser never talks to Ollama.
- Bring-your-own-key mode (default): the key lives only in the browser and is
  sent per-request; server, local-daemon and shared-key modes also supported.
- Client-side document extraction (pdf.js, mammoth, jszip) with scanned-PDF
  page rendering for the vision model; notes stay in their original language.
- ChatGPT-style shell: collapsible sidebar / mobile drawer, neutral token-based
  light + dark themes, folder organisation, PWA (manifest, SW, offline page).
- Strict JSON validation with zod + auto-repair, rate limiting, and request
  guards (cross-origin, body-size, API-key sanitising).
- setup.sh bootstraps deps, .env.local and a production build.

Gitignore excludes .env*, the generated pdf.js worker and local scratch files.

.env.example

@@ -0,0 +1,51 @@
+# ---------------------------------------------------------------------------
+# Freezmo - Ollama configuration
+# Copy this file to `.env.local` and adjust if needed.
+# ---------------------------------------------------------------------------
+
+# WHO PROVIDES THE API KEY -----------------------------------------------------
+#   user-key (default)  Every browser supplies its own key. The key is typed
+#                       into the settings dialog, kept in that browser's local
+#                       storage and sent with each request in the
+#                       `x-ollama-key` header. The server never stores it.
+#                       Point OLLAMA_BASE_URL at https://ollama.com.
+#   server              One key for everyone, read from OLLAMA_API_KEY below
+#                       (single-user installs). Nothing is sent from the client.
+#   local               No key at all: a local daemon signed in with
+#                       `ollama signin` proxies the cloud models.
+OLLAMA_AUTH=user-key
+
+# Ollama endpoint. https://ollama.com for cloud, http://localhost:11434 for a
+# local daemon. In user-key mode this is the endpoint the browser's key is sent
+# to; in server/local mode it is used directly.
+OLLAMA_BASE_URL=https://ollama.com
+
+# Only used when OLLAMA_AUTH=server. Never commit a real key.
+OLLAMA_API_KEY=
+
+# Model used for the vision/transcription step (reads photos of notes).
+# Must be multimodal — gpt-oss and other text-only models cannot be used here.
+# Free-tier friendly: gemma4:31b-cloud, kimi-k3:cloud (paid), mistral-large-3 (paid).
+VISION_MODEL=gemma4:31b-cloud
+
+# Model used to generate activities, grade short answers and restore the
+# language if a transcription came back translated. gpt-oss:120b is free-tier
+# friendly, very good at strict JSON and the strongest multilingual model in the
+# free plan. NOTE: it is text-only, so it can't be used as VISION_MODEL.
+# Free alternatives: nemotron-3-super:cloud, gpt-oss:20b-cloud.
+# Paid/credit: glm-5.3-flash:cloud, kimi-k3:cloud.
+TEXT_MODEL=gpt-oss:120b-cloud
+
+# RATE LIMITS (per client IP, sliding window, in-memory) ----------------------
+# Generation decks are expensive, so they are limited tightly by default.
+# RATE_LIMIT_WINDOW_MS=300000
+# RATE_LIMIT_GENERATE=12
+# RATE_LIMIT_GRADE=40
+# RATE_LIMIT_HEALTH=90
+
+# Optional tuning ------------------------------------------------------------
+# OLLAMA_TIMEOUT_MS=300000
+# OLLAMA_HEALTH_TIMEOUT_MS=8000
+# Send `think: false` to thinking models for faster JSON output.
+# OLLAMA_THINK=false
+# FREEZMO_DEFAULT_ACTIVITY_COUNT=10